54 lines
2.8 KiB
Diff
54 lines
2.8 KiB
Diff
# UNDF: UNDF-2026-000001186
|
|
--- a/src/output-json-http.c
|
|
+++ b/src/output-json-http.c
|
|
@@ -56,6 +56,10 @@ typedef struct LogHttpFileCtx_ {
|
|
uint32_t flags; /** Store mode */
|
|
uint64_t fields;/** Store fields */
|
|
+ /** CWE-407 fix: precomputed list of enabled htp_field name strings.
|
|
+ * Built once at config time so EveHttpLogJSONHeaders can do an O(E)
|
|
+ * scan over only the E enabled fields rather than O(HTTP_FIELD_SIZE=53)
|
|
+ * over all possible fields for every HTTP header in every transaction. */
|
|
+ const char *enabled_htp_fields[HTTP_FIELD_SIZE + 1]; /* NULL-terminated */
|
|
+ uint32_t enabled_htp_fields_cnt;
|
|
HttpXFFCfg *xff_cfg;
|
|
HttpXFFCfg *parent_xff_cfg;
|
|
OutputJsonCtx *eve_ctx;
|
|
@@ -322,11 +326,8 @@ static void EveHttpLogJSONHeaders(
|
|
if ((http_ctx->flags & direction) == 0 && http_ctx->fields != 0) {
|
|
bool tolog = false;
|
|
- for (HttpField f = HTTP_FIELD_ACCEPT; f < HTTP_FIELD_SIZE; f++) {
|
|
- if ((http_ctx->fields & (1ULL << f)) != 0) {
|
|
- if (((http_ctx->flags & LOG_HTTP_EXTENDED) == 0) ||
|
|
- ((http_ctx->flags & LOG_HTTP_EXTENDED) !=
|
|
- (http_fields[f].flags & LOG_HTTP_EXTENDED))) {
|
|
- if (bstr_cmp_c_nocase(htp_header_name(h), http_fields[f].htp_field)) {
|
|
- tolog = true;
|
|
- break;
|
|
- }
|
|
- }
|
|
- }
|
|
+ /* CWE-407 fix: iterate only the E enabled fields (E = enabled_htp_fields_cnt,
|
|
+ * typically 1-5) instead of all HTTP_FIELD_SIZE=53 fields per header. */
|
|
+ for (uint32_t ei = 0; ei < http_ctx->enabled_htp_fields_cnt; ei++) {
|
|
+ if (bstr_cmp_c_nocase(htp_header_name(h), http_ctx->enabled_htp_fields[ei])) {
|
|
+ tolog = true;
|
|
+ break;
|
|
+ }
|
|
}
|
|
if (!tolog) {
|
|
continue;
|
|
@@ -562,8 +563,15 @@ static OutputInitResult OutputHttpLogInitSub(SCConfNode *conf, OutputCtx *parent
|
|
HttpField f;
|
|
for (f = HTTP_FIELD_ACCEPT; f < HTTP_FIELD_SIZE; f++) {
|
|
if ((strcmp(http_fields[f].config_field, field->val) == 0) ||
|
|
(strcasecmp(http_fields[f].htp_field, field->val) == 0)) {
|
|
http_ctx->fields |= (1ULL << f);
|
|
+ /* CWE-407 fix: record this field's htp name in the
|
|
+ * enabled list for O(1)-per-field runtime filtering. */
|
|
+ if (http_ctx->enabled_htp_fields_cnt < HTTP_FIELD_SIZE) {
|
|
+ http_ctx->enabled_htp_fields[http_ctx->enabled_htp_fields_cnt++] =
|
|
+ http_fields[f].htp_field;
|
|
+ }
|
|
break;
|
|
}
|
|
}
|